October 14, 2021
What is Phishing?
Phishing, attacks through email, or malicious websites to infect your machine with malware and viruses to collect personal and financial information are the leading cause of data breaches, accounting for a whopping 90% of them. (Source: Retruster.) Phishing emails may appear to come from a financial institution, e-commerce site, government agency, or any other service, business, or individual. The email may also request personal information such as account numbers, passwords, or Social Security numbers. When users respond with the information or click on a link, attackers use the information to access users’ accounts.
How Costly is Phishing?
No company is spared from the cost of phishing attacks. Phishing gives attackers the best return on investment for their time and effort. A successful cyber-attack on a payment processor provides the hacker with credit card details. A hack on one individual can provide banking or credit card information to drain bank accounts and purchase merchandise. Phishing attacks peak in the US during the holiday season.
Some staggering facts:
- The average cost of a phishing attack to a mid-sized company is $1.6 million. (Source: Dashlane blog)
- Phishing emails are responsible for 94% of ransomware and $132,000 per business email compromise incident. (Source: Phish Insight)
- In 2018, a breach that involved tampering with or unauthorized access to an application cost $2 million more than a personally identifiable information breach on average. (Source: F5)
- North Korean national Park Jin Hyok carried out a successful multi-layer attack using phishing as its initial attack vector and stole $81 million from a Bangladesh bank. (Source: F5)
- In 2018, Google and Facebook lost $100 million due to an email phishing scheme. (Source: Inc. )
What are some tips to stop Phishing?
- Play hard to get with strangers.Links in emails and online posts are often the way cybercriminals compromise your computer. If you are unsure who an email is from—even if the details appear accurate—do not respond, and do not click on any links or attachments found in that email. Be cautious of generic greetings such as “Hello Bank Customer,” as these are often signs of phishing attempts. If you are concerned about the legitimacy of an email, call the company directly.
Think before you act. Be wary of communications that ask you to act immediately. Many phishing emails attempt to create a sense of urgency, causing the recipient to fear their account or information is in jeopardy. If you receive a suspicious email that appears to be from someone you know, reach out to that person directly on a separate secure platform. If the email comes from an organization but still looks suspicious, reach out to them via customer service to verify the communication.
- Protect your personal information. If people contacting you have key details from your life—your job title, email addresses, full name, and more that you may have published online somewhere—they can attempt a direct spear-phishing attack on you. Cybercriminals can also use social engineering with these details to try to manipulate you into skipping normal security protocols.
- Be wary of hyperlinks. Avoid clicking on hyperlinks in emails and hover over links to verify authenticity. Also, ensure that URLs begin with “https.” The “s” indicates encryption is enabled to protect users’ information.
- Double your login protection. Enable multi-factor authentication (MFA) to ensure that the only person who has access to your account is you. Use it for email, banking, social media, and any other service that requires logging in. If MFA is an option, enable it using a trusted mobile device, such
as your smartphone, an authenticator app, or a secure token—a small physical device that can hook onto your key ring.
- Shake up your password protocol. According to the National
Institute of Standards and Technology guidance, you should consider using the longest password or passphrase permissible. Get creative and customize your standard password for different sites, which can prevent cybercriminals from gaining access to these accounts and protect
you in the event of a breach. Use password managers to generate and remember different, complex passwords for each of your accounts.
- Install and update anti-virus software. Ensure all of your computers, Internet of Things devices, phones, and tablets are equipped with regularly updated anti-virus software, firewalls, email filters, and anti-spyware.
Dewpoint can help reduce your risk of being a victim of phishing and increase your organization’s overall security posture. For security awareness training, our partner KnowBe4 specializes in making sure your employees understand the mechanisms of spam, phishing, spear phishing, malware, ransomware, and social engineering and can apply this knowledge in their day-to-day job. Learn more about our full range of security services.
